EP3829141B1 - Cloud assisted management of devices - Google Patents
Cloud assisted management of devices Download PDFInfo
- Publication number
- EP3829141B1 EP3829141B1 EP21153051.4A EP21153051A EP3829141B1 EP 3829141 B1 EP3829141 B1 EP 3829141B1 EP 21153051 A EP21153051 A EP 21153051A EP 3829141 B1 EP3829141 B1 EP 3829141B1
- Authority
- EP
- European Patent Office
- Prior art keywords
- managed device
- token
- agent
- network
- pairing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 claims description 51
- 238000012546 transfer Methods 0.000 claims description 5
- 238000010200 validation analysis Methods 0.000 claims description 4
- 238000004590 computer program Methods 0.000 claims 1
- 238000007726 management method Methods 0.000 description 106
- 239000003795 chemical substances by application Substances 0.000 description 93
- 230000006870 function Effects 0.000 description 33
- 238000004891 communication Methods 0.000 description 29
- 230000008569 process Effects 0.000 description 18
- 238000013500 data storage Methods 0.000 description 9
- 238000003860 storage Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 7
- 238000012544 monitoring process Methods 0.000 description 7
- 238000013475 authorization Methods 0.000 description 5
- 230000007613 environmental effect Effects 0.000 description 5
- 230000000694 effects Effects 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 3
- 238000004519 manufacturing process Methods 0.000 description 3
- 230000004044 response Effects 0.000 description 3
- 238000012360 testing method Methods 0.000 description 3
- 238000012790 confirmation Methods 0.000 description 2
- 238000009826 distribution Methods 0.000 description 2
- 238000013519 translation Methods 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 239000006227 byproduct Substances 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000001816 cooling Methods 0.000 description 1
- 230000008878 coupling Effects 0.000 description 1
- 238000010168 coupling process Methods 0.000 description 1
- 238000005859 coupling reaction Methods 0.000 description 1
- 238000013523 data management Methods 0.000 description 1
- 230000007423 decrease Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 230000000977 initiatory effect Effects 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 238000007639 printing Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 239000000047 product Substances 0.000 description 1
- 239000000523 sample Substances 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L67/025—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP] for remote control or remote monitoring of applications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/56—Provisioning of proxy services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/04—Network management architectures or arrangements
- H04L41/046—Network management architectures or arrangements comprising network management agents or mobile agents therefor
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/50—Network service management, e.g. ensuring proper service fulfilment according to agreements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
- H04L63/0838—Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L67/125—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks involving control of end-device applications over a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
- H04L67/146—Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/54—Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
- H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
- H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
- H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
- H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/50—Secure pairing of devices
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/02—Standardisation; Integration
- H04L41/0213—Standardised network management protocols, e.g. simple network management protocol [SNMP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/02—Standardisation; Integration
- H04L41/0226—Mapping or translating multiple network management protocols
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
- H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
- H04L43/0817—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking functioning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2209/00—Arrangements in telecontrol or telemetry systems
- H04Q2209/40—Arrangements in telecontrol or telemetry systems using a wireless architecture
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04Q—SELECTING
- H04Q2209/00—Arrangements in telecontrol or telemetry systems
- H04Q2209/60—Arrangements in telecontrol or telemetry systems for transmitting utility meters data, i.e. transmission of data from the reader of the utility meter
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/70—Services for machine-to-machine communication [M2M] or machine type communication [MTC]
Definitions
- At least some embodiments described herein relate generally to remote management infrastructure and, more particularly, to managing and authenticating devices via cloud services.
- Device management systems and services provide customers an ability to control and configure devices on their network.
- the systems and devices being managed will typically implement a web service and present a management interface to a user via a web page, or may implement a protocol such as Simple Network Management Protocol (SNMP) which can be complex and costly to incorporate.
- SNMP Simple Network Management Protocol
- the user management interface requires the managed device to have additional components, software, memory, complexity, and expense to support a user interface for management, control, and reporting directly to a user or a client process (such as an SNMP agent or a web browser).
- United States patent publication US 2016/026201 exemplifies a system comprising a plurality of switch control panels, sensors and other devices which are communicatively coupled, via wireless means, to a hub which coordinates communication between these components and a cloud-based server.
- the system taught by said US 2016/026201 is further being characterised by the usage a cryptographic tokens to protect messages exchanged between these devices and the hub, as well as with the cloud-based server.
- Various aspects of the present disclosure relate to methods and apparatuses for local or remote management of devices via a cloud service.
- a cloud server is provided as defined in claim 1. Further embodiments are defined in the dependent claims.
- a method of managing a managed device is provided as defined in the claims.
- At least one embodiment disclosed herein includes apparatus and processes for implementing a cloud-based management model that simplifies and decreases the overall cost of managing hardware devices. For example, according to one embodiment, the cost of individual managed devices is reduced by manufacturing, configuring, and managing the devices with little or no resources on the device dedicated to performing user interface functions. For example, user interface functions conventionally performed by the device are instead performed by applications executing within a cloud service.
- one or more managed devices participates in a cloud-based management system to exchange identity, configuration, and other management information with a cloud service, a management agent, and a user.
- This information may include performance, status, control, environmental, and other information of a managed device.
- the cloud service communicates command and control information to the managed device, and according to some embodiments the cloud service presents a robust management interface to a management agent, and also may present a user interface to users, who may be local, in the vicinity of the managed device, or may be remote from the managed device.
- the cloud service receives and aggregates management information into data storage, such as a data warehouse, for analysis and reporting.
- This information may be used by product management and support personnel to gain insight into how customers use the managed devices and how the managed devices perform in the field, thereby informing their product roadmaps and call resolution activities.
- this information may be used to analyze controlled equipment, industrial process performance, energy usage, battery performance, environmental conditions, and other information accessible to managed devices.
- a cloud-based management system may follow a framework method of discovering devices, associating users with the devices, and managing the devices.
- Devices may be discovered by various discovery methods described below, including by cloud-aware devices that automatically report their existence to a cloud management service.
- Associating users may include authenticating protocols, as described in more detail below, to confirm that the user is authorized to manage the device.
- Some devices may be monitored only and not actively managed, or may be managed by the cloud management service according to a preset or pre-defined configuration without user intervention if, for example, no authenticated user is associated with the device.
- Management of a device by an associated (and authenticated) user occurs via the cloud management service, which allows the detailed implementation (and the associated complexity and cost) of a user interface to be implemented in the cloud service rather than on the managed device.
- the user management interface is provided by the cloud service, the user may be located anywhere in the world.
- references to "or” may be construed as inclusive so that any terms described using “or” may indicate any of a single, more than one, and all of the described terms.
- the term usage in the incorporated references is supplementary to that of this document; for irreconcilable inconsistencies, the term usage in this document controls.
- FIG. 1 illustrates an exemplary cloud-based management system 100.
- the cloud-based management system 100 includes a local user 102, a managed device 104, a local computer system 106, a cloud service infrastructure 108 including a cloud server 110, and a communication network 112. Also shown are a remote user 114 and a remote computer system 116.
- the cloud service infrastructure 108 may include additional components such as additional cloud servers, file servers, databases, etc.
- embodiments disclosed herein may interact with one or more users via one or more computer systems, such as additional local users, local computer systems, remote users, and remote computer systems.
- managed device 104 is shown in FIG. 1
- embodiments disclosed herein are not limited to a particular number of managed devices and several embodiments include multiple managed devices of various types. For instance, at least one embodiment includes cloud-enabled uninterruptible power supplies (UPS's) and cloud-enabled automatic control devices (ACD's).
- UPS's cloud-enabled uninterruptible power supplies
- ACD's cloud-enabled automatic control devices
- Various embodiments may include additional types of managed devices, examples of some of which are described further below.
- Each of the managed device 104 and the cloud server 110 includes a network interface and memory for storing information.
- the cloud service infrastructure 108 and the managed device 104 exchange (i.e., send or receive) information via the network 112.
- the managed device 104 may transmit information, such as identification, configuration, environmental, control, or performance information, to the cloud service infrastructure 108 through the network 112.
- the cloud service infrastructure 108 may transmit configuration or control information from, e.g., the cloud server 110, to the managed device 104 via the network 112.
- the network 112 may include any communication network through which computer systems exchange information.
- the network 112 may be a public network, such as the internet, and may include other public or private networks such as LANs or WANs utilizing any suitable network communication technology.
- the cloud-based management system 100 illustrated in FIG. 1 enables nearly ubiquitous access to centralized management and reporting of information from geographically diverse managed devices via cloud computing technology.
- Some embodiments include managed devices (e.g., the managed device 104) that supply physical resources, such as power and cooling, to other equipment.
- Examples of the physical resources provided by these managed devices include generators, uninterruptible power supplies, transformers, power distribution units (PDU's), outlets, computer room air handlers (CRAH's), rack-mounted air conditioners (RMAC's) and computer room air conditioners (CRAC's).
- Additional embodiments of managed devices include specialized computing devices, such as ACDs, that are specifically configured to control one or more industrial processes and to communicate with a cloud service, such as the cloud service infrastructure 108.
- ACDs One example of an ACD that may be included in accord with the embodiments disclosed herein is described in US Patent No.
- the managed devices disclosed here provide specific operations or functions that may be managed. These managed devices include enough computing resources to control the operation of the device, but the computing resources may be limited and tailored to support the specific operations performed by the managed device.
- the cloud-based management system 100 allows management, local or remote, of managed devices with limited computing resources.
- a UPS or any other managed device may have one or more AC power, DC power, battery, filter, inverter, and/or rectifier modules and may also have intelligence modules, controller modules, memory modules, display modules, diagnostic modules, reporting and/or statistical modules, or communications modules.
- Managed devices of various embodiments may have different or additional modules.
- Each module may provide an operation or function or set of operations or functions.
- the modules may be modular, i.e., removable or replaceable, or they may be integrated into a single unit.
- Any module of a managed device may have operational parameters that indicate a status or affect specific functions or operations, and the operational parameters may be manageable, e.g., readable, writeable, monitorable, configurable, by a controller, processor, or other suitable element.
- Example operational parameters for a UPS may include modes of operation, e.g., bypass mode; alarm thresholds; sensor information or settings regarding input and output power, current, voltage, frequency, phase; sensor information or settings regarding positions or status of circuit breakers, bypass switches, and relays; battery bus voltage, fan operation, and internal temperatures.
- UPS's and other types of managed devices may have additional or alternate manageable operational parameters.
- Management of a managed device may include reading, writing, monitoring, or configuring any of these or other parameters, and management information may include any information or communication containing values of, or commands related to, such parameters.
- FIG. 2 illustrates the cloud-based management system 100 with more detail in the local vicinity of the managed device 104.
- the managed device 104 is on a local network to which various IT equipment 202 is attached.
- the local computer system 106 runs a management agent 204, which is a software package that provides monitoring and management capability.
- the management agent 204 typically manages a number of the various IT equipment 202.
- the management agent 204 typically supports protocols such as SNMP and directly communicates with the IT equipment 202. As discussed above, this conventional method requires a managed device to support the protocols used by the management agent 204.
- the management agent 204 may be an application downloaded from an app store and may be capable of being run on a mobile device, i.e., the computer system 106 may be a tablet or a smart phone, for example, and the computer system 106 may be connected by a wired or wireless connection, and the management conducted by the management agent 204 may be directed to a managed device on a local network or on a remote network.
- At least one embodiment of the managed device 104 includes a controller 206 and a network interface 208.
- the controller 206 may control the managed device 104 in its primary operation and may also control communication, via the network interface 208, with other devices and systems, such as cloud service infrastructure 108.
- the controller 206 may also include a processor 210, a memory 212, and a storage 214.
- the memory 212 and the storage 214 may store executable instructions necessary for the operation of the managed device 104.
- the memory 212 and the storage 214 may also store information such as configuration settings, sensor or environmental data, statistical data, identifiers for various devices, such as the managed device 104 (itself) or the cloud service infrastructure 108, and any other suitable information. Examples of these components and the components more generally of devices such as the managed device 104, the computer systems 106, 116, the cloud server 110, and the various IT equipment 202 are discussed in more detail below with respect to FIG. 5 .
- a device such as the managed device 104
- a controller such as the controller 206, or a processor such as the processor 210
- a description of a function or a communication being performed herein may equivalently be described as the device, the controller, or the processor performing the function or communication.
- the managed device 104 need not support the protocols of the management agent 204 because the managed device 104 will not communicate directly with the management agent 204 and will instead communicate with the cloud service infrastructure 108 via a communication channel 216 across the network 112.
- the cloud service infrastructure 108 provides a protocol interface capable of communicating with the managed device 104.
- the cloud service infrastructure 108 also provides a protocol interface capable of communicating with the management agent 204 through a communication channel 218 across the network 112, such that the managed device 104 does not need to support such a protocol for, or communicate directly with, the management agent 204.
- the cloud service infrastructure 108 communicates with the management agent 204 on behalf of the managed device 104, which may allow the managed device 104 to be manufactured and configured with less computing capability, at a lower cost, than it otherwise would have.
- This architecture also allows the cloud service infrastructure 108 to receive monitoring and management information about the managed device 104 that it otherwise may not have, and allows the cloud service infrastructure 108 to provide monitoring and management to the managed device 104 that it otherwise may not have.
- the cloud service infrastructure 108 will remotely communicate with the managed device 104 using a lightweight machine-to-machine (LWM2M) protocol.
- LWM2M lightweight machine-to-machine
- the managed device 104 and the cloud service infrastructure 108 may additionally or alternatively communicate using a representational state transfer (REST) protocol, simple object access protocol (SOAP), hypertext transfer protocol (HTTP) or any other suitable protocol.
- REST representational state transfer
- SOAP simple object access protocol
- HTTP hypertext transfer protocol
- the cloud service infrastructure 108 may request or be provided additional information from the managed device 104, and the cloud service infrastructure 108 may perform monitoring and management functions directed to the managed device 104.
- Additional information from the managed device 104 may include, but is not limited to, configuration information, hardware and firmware version numbers, optionally installed hardware, authorization and authentication information (e.g., security and encryption keys) to be discussed in more detail below, environmental information (e.g., temperature and humidity information), control information (e.g., information that triggers a function, such as a shutdown or self-test), performance information (e.g., efficiency, battery life), diagnostic information, alerts, and any other relevant information.
- the cloud service infrastructure 108 will communicate with the management agent 204 by serving web pages, for example using HTTP or HTTPS, to present a device management interface to the local user 102.
- the cloud service infrastructure 108 may additionally or alternatively communicate with the management agent 204 using SNMP or any other suitable protocol.
- the cloud service infrastructure 108 will communicate with the management agent 204 using a protocol that requires more resources than those used to communicate with the managed device 104, thereby reducing the resources needed by the managed device 104 to be managed by the management agent 204.
- the management agent 204 need not be aware that it is not communicating directly with the managed device 104.
- the management agent 204 may be configured to communicate with the cloud service infrastructure 108 as if the cloud service infrastructure 108 is the managed device 104. In similar fashion, the managed device 104 need not be aware that management instructions may be coming from the management agent 204.
- the managed device 104 may be configured such that the cloud service infrastructure 108 is the management entity, from the perspective of the managed device 104.
- the management agent 204 may be any suitable agent, such as a web browser or a commercial remote monitoring and management (RMM) software suite, for example.
- RMM remote monitoring and management
- a remote user 114 may also use a management agent 204 on the remote computer system 116 to manage the managed device 104 in the same manner as discussed above with regard to FIG. 2 .
- the cloud service infrastructure 108 may appear to be the managed device 104 to the management agent 204, the management agent 204 may be located anywhere that has connectivity to the network 112.
- the management agent 204 may be manually set up or configured to communicate with the cloud service infrastructure 108 by an express configuration.
- the express configuration may indicate that the management agent 204 is managing a managed device 104 through a cloud service infrastructure 108.
- the management agent 204 may be configured to communicate with the cloud service infrastructure 108 as if the cloud service infrastructure 108 were the managed device 104, which is to say that the management agent 204 is not aware that the cloud service infrastructure 108 is acting as a proxy, or providing protocol translation, if any, to allow management of the managed device 104.
- the managed device 104 may be expressly configured to be managed by the management agent 204 through the cloud service infrastructure 108, or the managed device 104 may not be aware that it is communicating with a cloud service infrastructure 108, or the managed device 104 may not be aware that the management agent 204 is involved. In any of these cases, the management agent 204, the cloud service infrastructure 108, and/or the managed device 104 may be manually configured, pre-configured, or otherwise discover the other devices with which each is to communicate.
- devices may be manually configured (e.g., at the time of installation) with information necessary to participate in a cloud-based management system 100.
- An alternative method includes the managed devices being cloud-enabled or cloud-aware, e.g., as a default configuration.
- Another alternative method includes using network device discovery techniques or tools.
- Example embodiments of device configuration methods are described below.
- An implementation of a cloud-based management system 100 as disclosed herein may include any one or more of these device configuration methods, and may include other methods.
- a managed device 104 will be cloud-enabled or cloud-aware from the manufacturer as a default configuration.
- the managed device 104 is pre-configured with a network identifier to make contact with the cloud service infrastructure 108.
- the network identifier may include a URL, domain name, or IP address, or any combination of these identifiers or others.
- Examples of identifying information representative of the managed device 104 include, but are not limited to, a device name, a serial number, a stock-keeping unit (SKU) number, a model number, an IP address, and a media access control (MAC) address of a network interface.
- the managed device 104 uses a combination of serial number and SKU to generate a unique identifier (UID).
- the managed device 104 uses a MAC address as a unique identifier.
- a network device discovery tool will be used to identify devices on a network. Shown in FIG. 2 is a discovery agent 220 with network connectivity to the IT equipment 202 and the managed device 104.
- the discovery agent 220 is a software or hardware tool that probes the local network to identify what devices are attached.
- An example device discovery tool is Nmap (Network Mapper), an open source utility known in the art.
- the discovery agent 220 may discover devices by passively listening to the network or by probing the network with discovery request messages.
- Probing the network may include probing a set of possible addresses with low layer protocols, such as Address Resolution Protocol (ARP) or Internet Control Message Protocol (ICMP) messages; probing with higher layer protocols, which may include support for a User Datagram Protocol (UDP) broadcast request for all devices to respond, if so configured; probing for well-known ports; or probing for a specific protocol, for example.
- the discovery agent 220 may discover devices by any one or a combination of these or other methods.
- the discovery agent 220 requests an authorization token from the cloud service infrastructure 108 and broadcasts the authorization token on the local network.
- Potential managed devices such as the managed device 104, may be configured to respond to the broadcast if they recognize the authenticity of the authorization token.
- the discovery agent 220 may be included with the management agent 204 as a single software package capable of performing both discovery and management functions, or may be separate from the management agent 204. Additionally, the discovery agent 220 may be configured to communicate or gather information from another component, such as a third-party network discovery tool or a network management tool that holds information about the devices on the network.
- the discovery agent 220 compiles a list of device identifiers, typically including MAC addresses and IP address, and possibly including port numbers, device names, and the like.
- the discovery agent 220 may perform any combination of direct network probing, gathering information from other components, or other suitable methods of discovering devices on a network.
- the discovery agent 220 may be an application downloaded from an app store and may be capable of being run on a mobile device, such as a tablet or a smart phone, and the device associated with the discovery agent 220 may be connected to the network by a wired or wireless connection, and the discovery conducted by the discovery agent 220 may be directed to a local network or a remote network.
- the discovery agent 220 communicates with the cloud service infrastructure 108 to provide a list of identifiers associated with the devices attached to the network.
- the cloud service infrastructure 108 sorts the list to identify devices of particular interest, devices that are interesting, and devices that are not of interest.
- the cloud service infrastructure 108 may also compile statistical data about the devices, such as number of devices, manufacturer identities, etc., and the cloud service infrastructure 108 may make the statistical data available to users 102, 114, or others.
- the management agent 204 may receive and sort the list, and may compile statistics.
- the management agent 204 and the discovery agent 220 may each be part of the same hardware platform and/or the same software package running on a single computer system.
- the cloud-based management system 100 allows network management of managed devices, such as the managed device 104, that do not support direct management by a management agent, such as the management agent 204. Therefore, according to at least one embodiment, the cloud service infrastructure 108 may determine that devices capable of supporting direct management by a management agent are not of interest to the cloud service infrastructure 108. Whereas the cloud service infrastructure 108 may determine that devices of a certain manufacturer, or of a certain serial number or MAC address, are suited to management by the cloud service infrastructure 108 and therefore determine that such devices, e.g., managed device 104, are of interest and the cloud service infrastructure 108 may attempt to communicate with such devices to establish cloud based management.
- a management agent such as the management agent 204. Therefore, according to at least one embodiment, the cloud service infrastructure 108 may determine that devices capable of supporting direct management by a management agent are not of interest to the cloud service infrastructure 108. Whereas the cloud service infrastructure 108 may determine that devices of a certain manufacturer, or of a certain serial number or MAC address,
- cloud service infrastructure 108 may therefor maintain a database of such devices for follow up with users, such as local user 102 and/or remote user 114.
- the cloud service infrastructure 108 uses the MAC addresses provided by the discovery agent 220 to determine the manufacturer of listed devices.
- a MAC address includes an Organizational Unit Identifier (OUI) which indicates the manufacturer of the network interface hardware, and by association may indicate the manufacturer of the device in which the interface hardware is a part.
- the cloud service infrastructure 108 will include a database of MAC addresses for devices manufactured by one or more manufacturers. The database may further include the model number and/or serial number of the device associated with each MAC address. With a model number or serial number, the cloud service infrastructure 108 can identify the capabilities of the device, in some embodiments with queries to additional database information, to determine whether it is a device of particular interest, an interesting device, or a device that is not of interest.
- FIG. 3 illustrates a flow diagram of a method 300 of discovering devices for cloud-based management discussed above and in accordance with various embodiments.
- the discovery agent 220 is provided at block 302 by, e.g, downloading and installing the discovery agent 220.
- the discovery agent 220 is executed and discovers devices on the network at block 304.
- the discovery agent 220 performs device discovery by direct probing or by gathering details from another tool, as discussed above, or by any combination of these or other methods.
- the discovery agent 220 contacts the cloud service infrastructure 108 via the network 112 at block 306 and sends a list of discovered devices to the cloud service infrastructure 108 at block 310. Additionally, the discovery agent 220 may authenticate itself at block 308 before sending the list of discovered devices.
- the cloud service infrastructure 108 will compile statistical information about the discovered devices at block 312 and will sort the discovered devices into groups at block 314. Devices that are not of interest may be identified but ignored at block 316.
- the cloud service infrastructure 108 identifies devices of particular interest, e.g., devices that may be managed by the cloud service infrastructure 108, at block 318 and the cloud service infrastructure 108 may attempt to associate and manage these devices at block 320 and block 322, respectively. Association of devices is discussed in more detail below.
- the cloud service infrastructure 108 also identifies other devices that are interesting at block 324 and may store a list of such devices at block 326 and may request additional information about these devices at block 328.
- FIG. 4 illustrates one embodiment of an interchange of messages that can authenticate and associate an owner or user of a device to be managed in a cloud-based management system.
- the interchange of messages illustrated in FIG. 4 associates or pairs the owner or user with the device to be managed, and the pairing may be recorded in a database maintained by the cloud service infrastructure 108.
- Shown in FIG. 4 is the cloud service infrastructure 108, the managed device 104, an agent 400, and a series of messages communicated via the network 112.
- the agent 400 may be a management agent such as the management agent 204 of FIG. 2 , or may be a discovery agent such as the discovery agent 220 of FIG. 2 , or may be a combination of these or some other form of agent (implemented as software or hardware or a combination thereof) being used by a user, e.g., the local user 102 or the remote user 114.
- the agent 400 is credentialed by the cloud service infrastructure 108.
- the agent 400 may be provided by the same provider as the cloud service infrastructure 108 such that the agent 400 is trusted by the cloud service infrastructure 108, or the agent 400 may be a certified component from another provider, also trusted by the cloud service infrastructure 108, or the user, e.g., local user 102 or remote user 114, may provide credentials such as a username and password associated with an account maintained by the cloud service infrastructure 108. In some embodiments, one or more of these examples will serve to credential the agent 400.
- the interchange of messages illustrated by FIG. 4 relates to creating an association (or pairing) of the managed device 104 to a user's (e.g., users 102, 114) account with the cloud service infrastructure 108. Additionally or alternatively, the agent 400 may be associated with the managed device 104 or the user.
- the example interchange of FIG. 4 begins with a pairing request 410 from the agent 400.
- the pairing request includes an identification of the managed device 104.
- the cloud service infrastructure 108 may optionally determine whether the user is authorized to associate this particular managed device 104 to the user, whether the managed device 104 is already associated with another user, whether it is permissible to be associated with multiple users, and whether the association will be trusted, e.g., whether the user is authorized to communicate on the local network or whether the user is able to communicate on the local network.
- the cloud service infrastructure 108 determines that proceeding is appropriate, the cloud service infrastructure 108 sends an unlock message 420 to the managed device 104 that includes an unlock token. Receipt of the unlock message 420 indicates to the managed device 104 that a pairing has been requested and that the paring is approved by the cloud service infrastructure 108.
- the cloud service infrastructure 108 also sends a pairing message 430 including both the unlock token and a pairing token to the agent 400.
- the agent 400 receives the pairing message 430, the agent 400 sends an additional pairing message 440 to the managed device 104, including both the unlock token and the pairing token.
- the managed device 104 can validate the pairing message 440 by correlating it to the unlock message 420, because the unlock token provided in the pairing message 440 will match the unlock token provided in the unlock message 420.
- the managed device 104 sends a confirmation pairing message 450 to the cloud service infrastructure 108 that includes the pairing token.
- Each of the unlock token and the pairing token may be security tokens having cryptographic features, and may be random or pseudo-random, and may have timed expirations of any suitable amount of time, such as 5 minutes, for example.
- the cloud service infrastructure 108 may perform a validation 460 of the pairing token, such as by matching it to the pairing token sent in the pairing message 430, which was previously sent in response to the pairing request 410.
- the validation 460 may include sending additional messages internal or external to the cloud service infrastructure 108, such as for a database query.
- the cloud service infrastructure 108 Upon validating the received pairing token the cloud service infrastructure 108 also records an entry in the database that the user, or optionally the agent 400, is now associated, or paired, with the managed device 104, and the cloud service infrastructure 108 sends a confirmation message 470 to the agent 400.
- the agent 400 may indicate to the user that the pairing was successful.
- the result of the process discussed above is that the managed device 104 becomes associated, or paired, with the user's account or with the agent 400.
- the user or the agent 400 may now manage, monitor, generate reports, receive alerts, etc. with respect to managed device 104, or perform or use other tasks, components, or features within the capabilities of the cloud service infrastructure 108 or the managed device 104 as permitted by any permissions, groups, roles, or profiles imposed by the cloud service infrastructure 108 or the cloud-based management system 100.
- While the process discussed above is an exemplary interchange of messages to associate, or pair, a user (or agent) to a managed device in at least one embodiment, other embodiments may use different types or arrangements of messages.
- the cloud service infrastructure 108 is shown as making first contact with the managed device 104 in the example process of FIG. 4
- the managed device 104 may first contact the cloud service infrastructure 108, on its own accord or in response to a request from the agent 400.
- Such an embodiment may be desirable in cases where, for example, the managed device 104 is shielded from the network 112 by a firewall or a device implementing network address translation (NAT), which might prevent the cloud service infrastructure 108 from initiating communication with the managed device 104.
- NAT network address translation
- the managed device 104 may generate the tokens used in the pairing process, or the agent 400 may generate the tokens used in the pairing process.
- execution of a discovery process such as those described previously, and in particular a discovery process including an authorization token, may trigger a pairing request or may be treated as a pairing request by, e.g., the managed device 104, or the cloud service infrastructure 108.
- the agent 400 may send a list of device UID's, each UID uniquely identifying one device, such as the managed device 104, and the list of multiple devices may be deemed by the cloud service infrastructure 108 to be a request for pairing to each of the devices, and the cloud service infrastructure 108 may generate multiple unlock tokens and paring tokens to complete multiple pairings in accord with any of the processes discussed above.
- the pairing is achieved during the discovery process previously described.
- a list of one or more UID's may be provided to the cloud service infrastructure 108, as previously described.
- the cloud service infrastructure 108 may know the identity of a user, an owner, or a network on which the devices are connected and thereby associate (or pair) the devices with the user, owner, or network.
- the cloud service infrastructure 108 may associate the identified devices with an identifier of the agent or user (e.g., IP address or account information associated the management agent 204, the discovery agent 220, or the user 102).
- the UID of a device may indicate what user or agent it should be associated with or where it is located.
- the UID may include a serial number or MAC address, and a database of sales records may indicate who purchased the device.
- the UID or the communication packet in which it is communicated may include an IP address which may identify a network, include a network portion, or otherwise identify a group of related devices (e.g., on the same LAN) and the cloud service infrastructure 108 may associate the identified devices with an agent or user on record as being associated with the network, portion, or group.
- the cloud service infrastructure 108 can exchange a variety of information with the local user 102, the remote user 114, or an internal user associated with the cloud service infrastructure 108.
- the cloud service infrastructure 108 provides a dashboard user interface.
- the cloud service infrastructure 108 may present a user interface that mimics existing hardware and software interfaces (e.g., the interface provided by a Network Management Card ("NMC") such as a UPS NMC available from APC by Schneider Electric, the interface provided by Power Chute Business Edition available from APC by Schneider Electric, or the interface provided by an ACD.)
- NMC Network Management Card
- the cloud service infrastructure 108 is configured to issue an alert to a computer system, such as the local computer system 106, in response to receiving information describing an event of high importance.
- the alert issued by the cloud service infrastructure 108 is communicated via one or more channels through which the cloud service infrastructure 108 can communicate information to external entities, such as computer systems or telecommunication devices. Examples of such channels include email, text messaging, push notifications, and automated telephone calls.
- the cloud service infrastructure 108 provides different information to different types of users.
- the cloud service infrastructure 108 may discriminate what information to share based upon authentication and pairing as described above. This information may include monitoring information describing the performance characteristics of one or more managed devices, test information generated from periodic execution of tests by one or more managed devices, customer use information generated by customer interaction with one or more managed devices, service information generated by self-diagnostic activities executed by one or more managed devices, and operation information generated by operational activity of one or more managed devices.
- the cloud service infrastructure 108 may provide performance characteristics to engineering users, customer use information to marketing users, service information to re-sellers, distributors, or service organizations, and operation information to customers.
- Embodiments disclosed herein are not limited to the particular configurations illustrated. For example, some embodiments include multiple cloud services that operate in parallel to scale the computing resources available to the cloud-based management system. In some examples, multiple users of different types access the same managed device. In other examples, a single user accesses multiple managed devices. Thus embodiments are not limited by a specific number of users, managed devices, cloud services or cloud servers.
- the cloud service infrastructure 108 is implemented as a consolidated computer system, e.g., all components incorporated into cloud server 110. In other embodiments, the cloud service infrastructure 108 is implemented using a distributed computer system.
- aspects and functions described herein may be included as specialized hardware or software components executing in one or more computer systems.
- One or more acts of the methods described above may be performed with a computer, where at least one act is performed in a software program housed in a computer.
- Non-limiting examples of computer systems include, among others, network appliances, personal computers, workstations, mainframes, networked clients, servers, media servers, application servers, database servers and web servers.
- Other examples of computer systems may include mobile computing devices, such as cellular phones and personal digital assistants, and network equipment, such as load balancers, routers and switches.
- aspects may be located on a single computer system or may be distributed among a plurality of computer systems connected to one or more communications networks.
- aspects and functions may be distributed among one or more computer systems configured to provide a service to one or more client computers, or to perform an overall task as part of a distributed system. Additionally, aspects may be performed on a client-server or multi-tier system that includes components distributed among one or more server systems that perform various functions. Consequently, examples are not limited to executing on any particular system or group of systems. Further, aspects and functions may be implemented in software, hardware or firmware, or any combination thereof. Thus, aspects and functions may be implemented within methods, acts, systems, system elements and components using a variety of hardware and software configurations, and examples are not limited to any particular distributed architecture, network, or communication protocol.
- the distributed computer system 500 includes one or more computer systems that exchange information. More specifically, the distributed computer system 500 includes computer systems/devices 502, 504 and 506. As shown, the computer systems/devices 502, 504 and 506 are interconnected by, and may exchange data through, a communication network 508.
- the network 508 may include any communication network through which computer systems may exchange data.
- the computer systems/devices 502, 504 and 506 and the network 508 may use various methods, protocols and standards, including, among others, Fibre Channel, Token Ring, Ethernet, Wireless Ethernet, Bluetooth, IP, IPV6, TCP/IP, UDP, DTN, HTTP, FTP, SNMP, SMS, MMS, SS7, JSON, SOAP, CORBA, REST and Web Services.
- the computer systems 502, 504 and 506 may transmit data via the network 508 using a variety of security measures including, for example, TLS, SSL or VPN. While the distributed computer system 500 illustrates three networked computer systems, the distributed computer system 500 is not so limited and may include any number of computer systems and computing devices, networked using any medium and communication protocol.
- the computer system 502 includes a processor 510, a memory 512, an interconnection element 514, an interface 516 and data storage element 518.
- the processor 510 performs a series of instructions that result in manipulated data.
- the processor 510 may be any type of processor, multiprocessor or controller. Some example processors include commercially available processors such as an Intel Atom, Itanium, Core, Celeron, or Pentium processor, an AMD Opteron processor, an Apple A4 or A5 processor, a Sun UltraSPARC or IBM Power5+ processor and an IBM mainframe chip.
- the processor 510 is connected to other system components, including one or more memory devices 512, by the interconnection element 514.
- the memory 512 stores programs and data during operation of the computer system 502.
- the memory 512 may be a relatively high performance, volatile, random access memory such as a dynamic random access memory (“DRAM”) or static memory (“SRAM").
- the memory 512 may include any device for storing data, such as a disk drive or other nonvolatile storage device.
- Various examples may organize the memory 512 into particularized and, in some cases, unique structures to perform the functions disclosed herein. These data structures may be sized and organized to store values for particular data and types of data.
- the interconnection element 514 may include one or more physical busses, for example, busses between components that are integrated within a same machine, but may include any communication coupling between system elements including specialized or standard computing bus technologies such as IDE, SCSI, PCI and InfiniBand.
- the interconnection element 514 enables communications, such as data and instructions, to be exchanged between system components of the computer system 502.
- the computer system 502 also includes one or more interface devices 516 such as input devices, output devices and combination input/output devices.
- Interface devices may receive input or provide output. More particularly, output devices may render information for external presentation. Input devices may accept information from external sources. Examples of interface devices include keyboards, mouse devices, trackballs, microphones, touch screens, printing devices, display screens, speakers, network interface cards, etc. Interface devices allow the computer system 502 to exchange information and to communicate with external entities, such as users and other systems.
- the data storage element 518 includes a computer readable and writeable nonvolatile, or non-transitory, data storage medium in which instructions are stored that define a program or other object that is executed by the processor 510.
- the data storage element 518 also may include information that is recorded, on or in, the medium, and that is processed by the processor 510 during execution of the program. More specifically, the information may be stored in one or more data structures specifically configured to conserve storage space or increase data exchange performance.
- the instructions may be persistently stored as encoded signals, and the instructions may cause the processor 510 to perform any of the functions described herein.
- the medium may, for example, be optical disk, magnetic disk or flash memory, among others.
- the processor 510 or some other controller causes data to be read from the nonvolatile recording medium into another memory, such as the memory 512, that allows for faster access to the information by the processor 510 than does the storage medium included in the data storage element 518.
- the memory may be located in the data storage element 518 or in the memory 512, however, the processor 510 manipulates the data within the memory, and then copies the data to the storage medium associated with the data storage element 518 after processing is completed.
- a variety of components may manage data movement between the storage medium and other memory elements and examples are not limited to particular data management components. Further, examples are not limited to a particular memory system or data storage system.
- the computer system 502 as generally described provides one or more examples of the physical embodiments of a system that may be used to implement the various devices and components of the cloud-based management system 100.
- each of the managed device 104, the local computer system 106, the remote computer system 116, the various IT equipment 202, and components of the cloud service infrastructure 108, including the cloud server 110 may be implemented using a combination of the hardware structures as disclosed herein as the example computer system 502.
- the computer system 502 is shown by way of example as one type of computer system upon which various aspects and functions may be practiced, aspects and functions are not limited to being implemented on the computer system 502. Various aspects and functions may be practiced on one or more computers having a different architectures or components than that shown in FIG. 5 .
- the computer system 502 may include specially programmed, special-purpose hardware, such as an application-specific integrated circuit ("ASIC") tailored to perform a particular operation disclosed herein.
- ASIC application-specific integrated circuit
- another example may perform the same function using a grid of several computing devices running MAC OS X with IBM PowerPC processors and several specialized computing devices running proprietary hardware and operating systems.
- the computer system 502 may be a computer system including an operating system that manages at least a portion of the hardware elements included in the computer system 502.
- a processor or controller such as the processor 510, executes an operating system.
- Examples of a particular operating system that may be executed include a Windows-based operating system, such as the Windows 8 operating system, available from the Microsoft Corporation, a MAC OS X operating system or an iOS operating system available from Apple Computer, one of many Linux-based operating system distributions, for example, the Enterprise Linux operating system available from Red Hat Inc., a Solaris operating system available from Sun Microsystems, or a UNIX operating systems available from various sources. Many other operating systems may be used, and examples are not limited to any particular operating system.
- the processor 510 and operating system together define a computer platform for which application programs in high-level programming languages are written.
- These component applications may be executable, intermediate, bytecode or interpreted code which communicates over a communication network, for example, the Internet, using a communication protocol, for example, TCP/IP.
- aspects may be implemented using an object-oriented programming language, such as .Net, SmallTalk, Java, C++, Ada, C# (C-Sharp), Python, or JavaScript.
- object-oriented programming languages such as .Net, SmallTalk, Java, C++, Ada, C# (C-Sharp), Python, or JavaScript.
- Other object-oriented programming languages may also be used.
- functional, scripting, or logical programming languages may be used.
- various aspects and functions may be implemented in a non-programmed environment, for example, documents created in HTML, XML or other format that, when viewed in a window of a browser program, can render aspects of a graphical-user interface or perform other functions.
- various examples may be implemented as programmed or non-programmed elements, or any combination thereof.
- a web page may be implemented using HTML while a data object called from within the web page may be written in C++ or Python.
- the examples are not limited to a specific programming language and any suitable programming language could be used.
- the functional components disclosed herein may include a wide variety of elements, e.g. specialized hardware, executable code, data structures or objects, which are configured to perform the functions described herein.
- the components disclosed herein may read parameters that affect the functions performed by the components. These parameters may be physically stored in any form of suitable memory including volatile memory (such as RAM) or nonvolatile memory (such as a magnetic hard drive). In addition, the parameters may be logically stored in a propriety data structure (such as a database or file defined by a user mode application) or in a commonly shared data structure (such as an application registry that is defined by an operating system). In addition, some examples provide for both system and user interfaces that allow external entities to modify the parameters and thereby configure the behavior of the components.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computing Systems (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Medical Informatics (AREA)
- Computer And Data Communications (AREA)
- Telephonic Communication Services (AREA)
Description
- At least some embodiments described herein relate generally to remote management infrastructure and, more particularly, to managing and authenticating devices via cloud services.
- Device management systems and services provide customers an ability to control and configure devices on their network. In conventional management, the systems and devices being managed will typically implement a web service and present a management interface to a user via a web page, or may implement a protocol such as Simple Network Management Protocol (SNMP) which can be complex and costly to incorporate. In either of these and other cases, the user management interface requires the managed device to have additional components, software, memory, complexity, and expense to support a user interface for management, control, and reporting directly to a user or a client process (such as an SNMP agent or a web browser). United States patent publication
US 2016/026201 exemplifies a system comprising a plurality of switch control panels, sensors and other devices which are communicatively coupled, via wireless means, to a hub which coordinates communication between these components and a cloud-based server. The system taught by saidUS 2016/026201 is further being characterised by the usage a cryptographic tokens to protect messages exchanged between these devices and the hub, as well as with the cloud-based server. - Various aspects of the present disclosure relate to methods and apparatuses for local or remote management of devices via a cloud service.
- According to one aspect, a cloud server is provided as defined in claim 1. Further embodiments are defined in the dependent claims.
- According to another aspect, a method of managing a managed device is provided as defined in the claims.
- Still other aspects, embodiments and advantages of these exemplary aspects and embodiments, are discussed in detail below. Moreover, it is to be understood that both the foregoing information and the following detailed description are merely illustrative examples of various aspects and embodiments, and are intended to provide an overview or framework for understanding the nature and character of the claimed aspects and embodiments. Any embodiment disclosed herein may be combined with any other embodiment. References to "an embodiment," "an example," "some embodiments," "some examples," "an alternate embodiment," "various embodiments," "one embodiment," "at least one embodiment," "this and other embodiments" or the like are not necessarily mutually exclusive and are intended to indicate that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment. The appearances of such terms herein are not necessarily all referring to the same embodiment.
- Various aspects of at least one embodiment are discussed below with reference to the accompanying drawings, which are not intended to be drawn to scale. In the drawings, each identical or nearly identical component that is illustrated in various figures is represented by a like numeral. For purposes of clarity, not every component may be labeled in every drawing. In the drawings:
-
FIG. 1 is a schematic diagram of a cloud-based management system including a cloud managed device; -
FIG. 2 is a schematic diagram of the cloud-based management system ofFIG. 1 showing local detail at the managed device; -
FIG. 3 is a flow diagram of a network discovery process in accord with the cloud-based management system; -
FIG. 4 is a schematic diagram of a pairing process showing message communications according to at least one embodiment; and -
FIG. 5 is a schematic diagram of a computer system in accord with aspects and embodiments disclosed herein. - There exists a need for a less complex and light weight device management architecture that allows managed devices to implement simple interfaces at lower cost while maintaining a robust user experience and capability. At least one embodiment disclosed herein includes apparatus and processes for implementing a cloud-based management model that simplifies and decreases the overall cost of managing hardware devices. For example, according to one embodiment, the cost of individual managed devices is reduced by manufacturing, configuring, and managing the devices with little or no resources on the device dedicated to performing user interface functions. For example, user interface functions conventionally performed by the device are instead performed by applications executing within a cloud service.
- In embodiments, one or more managed devices participates in a cloud-based management system to exchange identity, configuration, and other management information with a cloud service, a management agent, and a user. This information may include performance, status, control, environmental, and other information of a managed device. Additionally, the cloud service communicates command and control information to the managed device, and according to some embodiments the cloud service presents a robust management interface to a management agent, and also may present a user interface to users, who may be local, in the vicinity of the managed device, or may be remote from the managed device.
- In some embodiments, the cloud service receives and aggregates management information into data storage, such as a data warehouse, for analysis and reporting. This information may be used by product management and support personnel to gain insight into how customers use the managed devices and how the managed devices perform in the field, thereby informing their product roadmaps and call resolution activities. In addition, this information may be used to analyze controlled equipment, industrial process performance, energy usage, battery performance, environmental conditions, and other information accessible to managed devices.
- In accordance with some aspects, a cloud-based management system may follow a framework method of discovering devices, associating users with the devices, and managing the devices. Devices may be discovered by various discovery methods described below, including by cloud-aware devices that automatically report their existence to a cloud management service. Associating users may include authenticating protocols, as described in more detail below, to confirm that the user is authorized to manage the device. Some devices may be monitored only and not actively managed, or may be managed by the cloud management service according to a preset or pre-defined configuration without user intervention if, for example, no authenticated user is associated with the device. Management of a device by an associated (and authenticated) user occurs via the cloud management service, which allows the detailed implementation (and the associated complexity and cost) of a user interface to be implemented in the cloud service rather than on the managed device. In part because the user management interface is provided by the cloud service, the user may be located anywhere in the world.
- Examples of the methods and systems discussed herein are not limited in application to the details of construction and the arrangement of components set forth in the following description or illustrated in the accompanying drawings. The methods and systems are capable of implementation in other embodiments and of being practiced or of being carried out in various ways. Examples of specific implementations are provided herein for illustrative purposes only and are not intended to be limiting. In particular, acts, components, elements and features discussed in connection with any one or more examples are not intended to be excluded from a similar role in any other examples.
- Also, the phraseology and terminology used herein is for the purpose of description and should not be regarded as limiting. Any references to examples, embodiments, components, elements or acts of the systems and methods herein referred to in the singular may also embrace embodiments including a plurality, and any references in plural to any embodiment, component, element or act herein may also embrace embodiments including only a singularity. References in the singular or plural form are not intended to limit the presently disclosed systems or methods, their components, acts, or elements. The use herein of "including," "comprising," "having," "containing," "involving," and variations thereof is meant to encompass the items listed thereafter and equivalents thereof as well as additional items. References to "or" may be construed as inclusive so that any terms described using "or" may indicate any of a single, more than one, and all of the described terms. In addition, in the event of inconsistent usages of terms between this document and documents incorporated herein by reference, the term usage in the incorporated references is supplementary to that of this document; for irreconcilable inconsistencies, the term usage in this document controls.
- Various embodiments disclosed herein implement a cloud-based management system using one or more computer systems and one or more managed devices. As described further below, the cloud-based management system manages and monitors the operation of one or more managed devices.
FIG. 1 illustrates an exemplary cloud-basedmanagement system 100. As shown, the cloud-basedmanagement system 100 includes alocal user 102, a manageddevice 104, alocal computer system 106, acloud service infrastructure 108 including acloud server 110, and acommunication network 112. Also shown are aremote user 114 and aremote computer system 116. Thecloud service infrastructure 108 may include additional components such as additional cloud servers, file servers, databases, etc. Although only onelocal user 102 and onelocal computer system 106, and only oneremote user 114 and oneremote computer system 116, is shown inFIG. 1 , embodiments disclosed herein may interact with one or more users via one or more computer systems, such as additional local users, local computer systems, remote users, and remote computer systems. In addition, although only one manageddevice 104 is shown inFIG. 1 , embodiments disclosed herein are not limited to a particular number of managed devices and several embodiments include multiple managed devices of various types. For instance, at least one embodiment includes cloud-enabled uninterruptible power supplies (UPS's) and cloud-enabled automatic control devices (ACD's). Various embodiments may include additional types of managed devices, examples of some of which are described further below. - Each of the managed
device 104 and thecloud server 110 includes a network interface and memory for storing information. Thecloud service infrastructure 108 and the manageddevice 104 exchange (i.e., send or receive) information via thenetwork 112. For instance, the manageddevice 104 may transmit information, such as identification, configuration, environmental, control, or performance information, to thecloud service infrastructure 108 through thenetwork 112. Conversely, thecloud service infrastructure 108 may transmit configuration or control information from, e.g., thecloud server 110, to the manageddevice 104 via thenetwork 112. Thenetwork 112 may include any communication network through which computer systems exchange information. For example, thenetwork 112 may be a public network, such as the internet, and may include other public or private networks such as LANs or WANs utilizing any suitable network communication technology. - The cloud-based
management system 100 illustrated inFIG. 1 enables nearly ubiquitous access to centralized management and reporting of information from geographically diverse managed devices via cloud computing technology. - Some embodiments include managed devices (e.g., the managed device 104) that supply physical resources, such as power and cooling, to other equipment. Examples of the physical resources provided by these managed devices include generators, uninterruptible power supplies, transformers, power distribution units (PDU's), outlets, computer room air handlers (CRAH's), rack-mounted air conditioners (RMAC's) and computer room air conditioners (CRAC's). Additional embodiments of managed devices include specialized computing devices, such as ACDs, that are specifically configured to control one or more industrial processes and to communicate with a cloud service, such as the
cloud service infrastructure 108. One example of an ACD that may be included in accord with the embodiments disclosed herein is described inUS Patent No. 6,640,140, titled PLC EXECUTIVE WITH INTEGRATED WEB SERVER, issued October 28, 2003 . Examples of UPS's that may be included in accord with the embodiments disclosed herein are described inUS Patent No. 7,446,433, titled METHODS AND APPARATUS FOR PROVIDING UNINTERRUPTIBLE POWER, issued November 4, 2008 , andUS Patent No. 8,476,787, titled SYSTEM AND METHOD FOR CHANGING POWER STATES OF A POWER DEVICE, issued July 2, 2013 . - The managed devices disclosed here provide specific operations or functions that may be managed. These managed devices include enough computing resources to control the operation of the device, but the computing resources may be limited and tailored to support the specific operations performed by the managed device. In various embodiments, the cloud-based
management system 100 allows management, local or remote, of managed devices with limited computing resources. - The managed devices disclosed herein may provide specific operations or functions by various hardware and software modules. For example, a UPS or any other managed device may have one or more AC power, DC power, battery, filter, inverter, and/or rectifier modules and may also have intelligence modules, controller modules, memory modules, display modules, diagnostic modules, reporting and/or statistical modules, or communications modules. Managed devices of various embodiments may have different or additional modules. Each module may provide an operation or function or set of operations or functions. The modules may be modular, i.e., removable or replaceable, or they may be integrated into a single unit.
- Any module of a managed device may have operational parameters that indicate a status or affect specific functions or operations, and the operational parameters may be manageable, e.g., readable, writeable, monitorable, configurable, by a controller, processor, or other suitable element. Example operational parameters for a UPS may include modes of operation, e.g., bypass mode; alarm thresholds; sensor information or settings regarding input and output power, current, voltage, frequency, phase; sensor information or settings regarding positions or status of circuit breakers, bypass switches, and relays; battery bus voltage, fan operation, and internal temperatures. UPS's and other types of managed devices may have additional or alternate manageable operational parameters. Management of a managed device may include reading, writing, monitoring, or configuring any of these or other parameters, and management information may include any information or communication containing values of, or commands related to, such parameters.
-
FIG. 2 illustrates the cloud-basedmanagement system 100 with more detail in the local vicinity of the manageddevice 104. The manageddevice 104 is on a local network to whichvarious IT equipment 202 is attached. In a conventional management configuration, thelocal computer system 106 runs amanagement agent 204, which is a software package that provides monitoring and management capability. Themanagement agent 204 typically manages a number of thevarious IT equipment 202. Themanagement agent 204 typically supports protocols such as SNMP and directly communicates with theIT equipment 202. As discussed above, this conventional method requires a managed device to support the protocols used by themanagement agent 204. - In some embodiments, the
management agent 204 may be an application downloaded from an app store and may be capable of being run on a mobile device, i.e., thecomputer system 106 may be a tablet or a smart phone, for example, and thecomputer system 106 may be connected by a wired or wireless connection, and the management conducted by themanagement agent 204 may be directed to a managed device on a local network or on a remote network. - At least one embodiment of the managed
device 104 includes acontroller 206 and anetwork interface 208. Thecontroller 206 may control the manageddevice 104 in its primary operation and may also control communication, via thenetwork interface 208, with other devices and systems, such ascloud service infrastructure 108. Thecontroller 206 may also include aprocessor 210, amemory 212, and astorage 214. Thememory 212 and thestorage 214 may store executable instructions necessary for the operation of the manageddevice 104. Thememory 212 and thestorage 214 may also store information such as configuration settings, sensor or environmental data, statistical data, identifiers for various devices, such as the managed device 104 (itself) or thecloud service infrastructure 108, and any other suitable information. Examples of these components and the components more generally of devices such as the manageddevice 104, thecomputer systems cloud server 110, and thevarious IT equipment 202 are discussed in more detail below with respect toFIG. 5 . - In descriptions included herein, a device, such as the managed
device 104, may be described as performing a function or communicating with other devices, and when the device performs the function or communicates with another device, a controller such as thecontroller 206, or a processor such as theprocessor 210, may be controlling or causing the function to be performed or the communication to be carried out. Accordingly, a description of a function or a communication being performed herein may equivalently be described as the device, the controller, or the processor performing the function or communication. - In at least one embodiment of the cloud-based
management system 100, the manageddevice 104 need not support the protocols of themanagement agent 204 because the manageddevice 104 will not communicate directly with themanagement agent 204 and will instead communicate with thecloud service infrastructure 108 via acommunication channel 216 across thenetwork 112. Thecloud service infrastructure 108 provides a protocol interface capable of communicating with the manageddevice 104. Thecloud service infrastructure 108 also provides a protocol interface capable of communicating with themanagement agent 204 through acommunication channel 218 across thenetwork 112, such that the manageddevice 104 does not need to support such a protocol for, or communicate directly with, themanagement agent 204. In this manner, thecloud service infrastructure 108 communicates with themanagement agent 204 on behalf of the manageddevice 104, which may allow the manageddevice 104 to be manufactured and configured with less computing capability, at a lower cost, than it otherwise would have. This architecture also allows thecloud service infrastructure 108 to receive monitoring and management information about the manageddevice 104 that it otherwise may not have, and allows thecloud service infrastructure 108 to provide monitoring and management to the manageddevice 104 that it otherwise may not have. - In some embodiments, the
cloud service infrastructure 108 will remotely communicate with the manageddevice 104 using a lightweight machine-to-machine (LWM2M) protocol. The manageddevice 104 and thecloud service infrastructure 108 may additionally or alternatively communicate using a representational state transfer (REST) protocol, simple object access protocol (SOAP), hypertext transfer protocol (HTTP) or any other suitable protocol. - Once communication is established between the managed
device 104 and thecloud service infrastructure 108, thecloud service infrastructure 108 may request or be provided additional information from the manageddevice 104, and thecloud service infrastructure 108 may perform monitoring and management functions directed to the manageddevice 104. Additional information from the manageddevice 104 may include, but is not limited to, configuration information, hardware and firmware version numbers, optionally installed hardware, authorization and authentication information (e.g., security and encryption keys) to be discussed in more detail below, environmental information (e.g., temperature and humidity information), control information (e.g., information that triggers a function, such as a shutdown or self-test), performance information (e.g., efficiency, battery life), diagnostic information, alerts, and any other relevant information. - In some embodiments, the
cloud service infrastructure 108 will communicate with themanagement agent 204 by serving web pages, for example using HTTP or HTTPS, to present a device management interface to thelocal user 102. Thecloud service infrastructure 108 may additionally or alternatively communicate with themanagement agent 204 using SNMP or any other suitable protocol. In various embodiments, thecloud service infrastructure 108 will communicate with themanagement agent 204 using a protocol that requires more resources than those used to communicate with the manageddevice 104, thereby reducing the resources needed by the manageddevice 104 to be managed by themanagement agent 204. - In view of the various embodiments discussed above, the
management agent 204 need not be aware that it is not communicating directly with the manageddevice 104. Themanagement agent 204 may be configured to communicate with thecloud service infrastructure 108 as if thecloud service infrastructure 108 is the manageddevice 104. In similar fashion, the manageddevice 104 need not be aware that management instructions may be coming from themanagement agent 204. The manageddevice 104 may be configured such that thecloud service infrastructure 108 is the management entity, from the perspective of the manageddevice 104. Themanagement agent 204 may be any suitable agent, such as a web browser or a commercial remote monitoring and management (RMM) software suite, for example. One such RMM known in the industry is VSA™ by Kaseya Limited. - Referring again to
FIG. 1 , aremote user 114 may also use amanagement agent 204 on theremote computer system 116 to manage the manageddevice 104 in the same manner as discussed above with regard toFIG. 2 . Because thecloud service infrastructure 108 may appear to be the manageddevice 104 to themanagement agent 204, themanagement agent 204 may be located anywhere that has connectivity to thenetwork 112. - With continued reference to
FIG. 2 , in some embodiments themanagement agent 204 may be manually set up or configured to communicate with thecloud service infrastructure 108 by an express configuration. The express configuration may indicate that themanagement agent 204 is managing a manageddevice 104 through acloud service infrastructure 108. Alternatively, themanagement agent 204 may be configured to communicate with thecloud service infrastructure 108 as if thecloud service infrastructure 108 were the manageddevice 104, which is to say that themanagement agent 204 is not aware that thecloud service infrastructure 108 is acting as a proxy, or providing protocol translation, if any, to allow management of the manageddevice 104. - In a similar fashion, the managed
device 104 may be expressly configured to be managed by themanagement agent 204 through thecloud service infrastructure 108, or the manageddevice 104 may not be aware that it is communicating with acloud service infrastructure 108, or the manageddevice 104 may not be aware that themanagement agent 204 is involved. In any of these cases, themanagement agent 204, thecloud service infrastructure 108, and/or the manageddevice 104 may be manually configured, pre-configured, or otherwise discover the other devices with which each is to communicate. - As discussed above, devices may be manually configured (e.g., at the time of installation) with information necessary to participate in a cloud-based
management system 100. An alternative method includes the managed devices being cloud-enabled or cloud-aware, e.g., as a default configuration. Another alternative method includes using network device discovery techniques or tools. Example embodiments of device configuration methods are described below. An implementation of a cloud-basedmanagement system 100 as disclosed herein may include any one or more of these device configuration methods, and may include other methods. - In some embodiments, a managed
device 104 will be cloud-enabled or cloud-aware from the manufacturer as a default configuration. In such embodiments, the manageddevice 104 is pre-configured with a network identifier to make contact with thecloud service infrastructure 108. The network identifier may include a URL, domain name, or IP address, or any combination of these identifiers or others. When the manageddevice 104 is connected to power and a network, and has a basic or default configuration sufficient to communicate over thenetwork 112, the manageddevice 104 will attempt to establish achannel 216 to communicate with thecloud service infrastructure 108 using the network identifier. The manageddevice 104 will then provide to thecloud service infrastructure 108 identifying information representative of the manageddevice 104. Examples of identifying information representative of the manageddevice 104 include, but are not limited to, a device name, a serial number, a stock-keeping unit (SKU) number, a model number, an IP address, and a media access control (MAC) address of a network interface. In some embodiments the manageddevice 104 uses a combination of serial number and SKU to generate a unique identifier (UID). In some embodiments the manageddevice 104 uses a MAC address as a unique identifier. - In some embodiments, a network device discovery tool will be used to identify devices on a network. Shown in
FIG. 2 is adiscovery agent 220 with network connectivity to theIT equipment 202 and the manageddevice 104. Thediscovery agent 220 is a software or hardware tool that probes the local network to identify what devices are attached. An example device discovery tool is Nmap (Network Mapper), an open source utility known in the art. Thediscovery agent 220 may discover devices by passively listening to the network or by probing the network with discovery request messages. Probing the network may include probing a set of possible addresses with low layer protocols, such as Address Resolution Protocol (ARP) or Internet Control Message Protocol (ICMP) messages; probing with higher layer protocols, which may include support for a User Datagram Protocol (UDP) broadcast request for all devices to respond, if so configured; probing for well-known ports; or probing for a specific protocol, for example. Thediscovery agent 220 may discover devices by any one or a combination of these or other methods. - In some embodiments the
discovery agent 220 requests an authorization token from thecloud service infrastructure 108 and broadcasts the authorization token on the local network. Potential managed devices, such as the manageddevice 104, may be configured to respond to the broadcast if they recognize the authenticity of the authorization token. - The
discovery agent 220 may be included with themanagement agent 204 as a single software package capable of performing both discovery and management functions, or may be separate from themanagement agent 204. Additionally, thediscovery agent 220 may be configured to communicate or gather information from another component, such as a third-party network discovery tool or a network management tool that holds information about the devices on the network. - The result of the discovery processes described is that the
discovery agent 220 compiles a list of device identifiers, typically including MAC addresses and IP address, and possibly including port numbers, device names, and the like. In various embodiments, thediscovery agent 220 may perform any combination of direct network probing, gathering information from other components, or other suitable methods of discovering devices on a network. - In some embodiments, the
discovery agent 220 may be an application downloaded from an app store and may be capable of being run on a mobile device, such as a tablet or a smart phone, and the device associated with thediscovery agent 220 may be connected to the network by a wired or wireless connection, and the discovery conducted by thediscovery agent 220 may be directed to a local network or a remote network. - According to at least one embodiment, the
discovery agent 220 communicates with thecloud service infrastructure 108 to provide a list of identifiers associated with the devices attached to the network. Thecloud service infrastructure 108 sorts the list to identify devices of particular interest, devices that are interesting, and devices that are not of interest. Thecloud service infrastructure 108 may also compile statistical data about the devices, such as number of devices, manufacturer identities, etc., and thecloud service infrastructure 108 may make the statistical data available tousers management agent 204 may receive and sort the list, and may compile statistics. In various embodiments, themanagement agent 204 and thediscovery agent 220 may each be part of the same hardware platform and/or the same software package running on a single computer system. - According to at least one aspect, the cloud-based
management system 100 allows network management of managed devices, such as the manageddevice 104, that do not support direct management by a management agent, such as themanagement agent 204. Therefore, according to at least one embodiment, thecloud service infrastructure 108 may determine that devices capable of supporting direct management by a management agent are not of interest to thecloud service infrastructure 108. Whereas thecloud service infrastructure 108 may determine that devices of a certain manufacturer, or of a certain serial number or MAC address, are suited to management by thecloud service infrastructure 108 and therefore determine that such devices, e.g., manageddevice 104, are of interest and thecloud service infrastructure 108 may attempt to communicate with such devices to establish cloud based management. Other devices may be interesting because they are manufactured by competitors or provide capabilities of interest or may provide business opportunities for, e.g., service contracts, upgrade, or replacement, etc. andcloud service infrastructure 108 may therefor maintain a database of such devices for follow up with users, such aslocal user 102 and/orremote user 114. - In some embodiments, the
cloud service infrastructure 108 uses the MAC addresses provided by thediscovery agent 220 to determine the manufacturer of listed devices. A MAC address includes an Organizational Unit Identifier (OUI) which indicates the manufacturer of the network interface hardware, and by association may indicate the manufacturer of the device in which the interface hardware is a part. Additionally, in some embodiments thecloud service infrastructure 108 will include a database of MAC addresses for devices manufactured by one or more manufacturers. The database may further include the model number and/or serial number of the device associated with each MAC address. With a model number or serial number, thecloud service infrastructure 108 can identify the capabilities of the device, in some embodiments with queries to additional database information, to determine whether it is a device of particular interest, an interesting device, or a device that is not of interest. -
FIG. 3 illustrates a flow diagram of a method 300 of discovering devices for cloud-based management discussed above and in accordance with various embodiments. Thediscovery agent 220 is provided atblock 302 by, e.g, downloading and installing thediscovery agent 220. Thediscovery agent 220 is executed and discovers devices on the network atblock 304. Thediscovery agent 220 performs device discovery by direct probing or by gathering details from another tool, as discussed above, or by any combination of these or other methods. Thediscovery agent 220 contacts thecloud service infrastructure 108 via thenetwork 112 atblock 306 and sends a list of discovered devices to thecloud service infrastructure 108 atblock 310. Additionally, thediscovery agent 220 may authenticate itself atblock 308 before sending the list of discovered devices. Thecloud service infrastructure 108 will compile statistical information about the discovered devices atblock 312 and will sort the discovered devices into groups atblock 314. Devices that are not of interest may be identified but ignored atblock 316. Thecloud service infrastructure 108 identifies devices of particular interest, e.g., devices that may be managed by thecloud service infrastructure 108, atblock 318 and thecloud service infrastructure 108 may attempt to associate and manage these devices atblock 320 and block 322, respectively. Association of devices is discussed in more detail below. Thecloud service infrastructure 108 also identifies other devices that are interesting atblock 324 and may store a list of such devices atblock 326 and may request additional information about these devices atblock 328. -
FIG. 4 illustrates one embodiment of an interchange of messages that can authenticate and associate an owner or user of a device to be managed in a cloud-based management system. The interchange of messages illustrated inFIG. 4 associates or pairs the owner or user with the device to be managed, and the pairing may be recorded in a database maintained by thecloud service infrastructure 108. Shown inFIG. 4 is thecloud service infrastructure 108, the manageddevice 104, anagent 400, and a series of messages communicated via thenetwork 112. - The
agent 400 may be a management agent such as themanagement agent 204 ofFIG. 2 , or may be a discovery agent such as thediscovery agent 220 ofFIG. 2 , or may be a combination of these or some other form of agent (implemented as software or hardware or a combination thereof) being used by a user, e.g., thelocal user 102 or theremote user 114. In at least one embodiment, theagent 400 is credentialed by thecloud service infrastructure 108. For example, theagent 400 may be provided by the same provider as thecloud service infrastructure 108 such that theagent 400 is trusted by thecloud service infrastructure 108, or theagent 400 may be a certified component from another provider, also trusted by thecloud service infrastructure 108, or the user, e.g.,local user 102 orremote user 114, may provide credentials such as a username and password associated with an account maintained by thecloud service infrastructure 108. In some embodiments, one or more of these examples will serve to credential theagent 400. - The interchange of messages illustrated by
FIG. 4 relates to creating an association (or pairing) of the manageddevice 104 to a user's (e.g.,users 102, 114) account with thecloud service infrastructure 108. Additionally or alternatively, theagent 400 may be associated with the manageddevice 104 or the user. The example interchange ofFIG. 4 begins with apairing request 410 from theagent 400. The pairing request includes an identification of the manageddevice 104. Thecloud service infrastructure 108 may optionally determine whether the user is authorized to associate this particular manageddevice 104 to the user, whether the manageddevice 104 is already associated with another user, whether it is permissible to be associated with multiple users, and whether the association will be trusted, e.g., whether the user is authorized to communicate on the local network or whether the user is able to communicate on the local network. - If the
cloud service infrastructure 108 determines that proceeding is appropriate, thecloud service infrastructure 108 sends anunlock message 420 to the manageddevice 104 that includes an unlock token. Receipt of theunlock message 420 indicates to the manageddevice 104 that a pairing has been requested and that the paring is approved by thecloud service infrastructure 108. Thecloud service infrastructure 108 also sends apairing message 430 including both the unlock token and a pairing token to theagent 400. When theagent 400 receives thepairing message 430, theagent 400 sends anadditional pairing message 440 to the manageddevice 104, including both the unlock token and the pairing token. The manageddevice 104 can validate thepairing message 440 by correlating it to theunlock message 420, because the unlock token provided in thepairing message 440 will match the unlock token provided in theunlock message 420. The manageddevice 104 sends aconfirmation pairing message 450 to thecloud service infrastructure 108 that includes the pairing token. Each of the unlock token and the pairing token may be security tokens having cryptographic features, and may be random or pseudo-random, and may have timed expirations of any suitable amount of time, such as 5 minutes, for example. Thecloud service infrastructure 108 may perform avalidation 460 of the pairing token, such as by matching it to the pairing token sent in thepairing message 430, which was previously sent in response to thepairing request 410. Thevalidation 460 may include sending additional messages internal or external to thecloud service infrastructure 108, such as for a database query. Upon validating the received pairing token thecloud service infrastructure 108 also records an entry in the database that the user, or optionally theagent 400, is now associated, or paired, with the manageddevice 104, and thecloud service infrastructure 108 sends a confirmation message 470 to theagent 400. Theagent 400 may indicate to the user that the pairing was successful. - In various embodiments, the result of the process discussed above is that the managed
device 104 becomes associated, or paired, with the user's account or with theagent 400. As a result, the user or theagent 400 may now manage, monitor, generate reports, receive alerts, etc. with respect to manageddevice 104, or perform or use other tasks, components, or features within the capabilities of thecloud service infrastructure 108 or the manageddevice 104 as permitted by any permissions, groups, roles, or profiles imposed by thecloud service infrastructure 108 or the cloud-basedmanagement system 100. - While the process discussed above is an exemplary interchange of messages to associate, or pair, a user (or agent) to a managed device in at least one embodiment, other embodiments may use different types or arrangements of messages. For example, while the
cloud service infrastructure 108 is shown as making first contact with the manageddevice 104 in the example process ofFIG. 4 , in some embodiments the manageddevice 104 may first contact thecloud service infrastructure 108, on its own accord or in response to a request from theagent 400. Such an embodiment may be desirable in cases where, for example, the manageddevice 104 is shielded from thenetwork 112 by a firewall or a device implementing network address translation (NAT), which might prevent thecloud service infrastructure 108 from initiating communication with the manageddevice 104. In various embodiments, the manageddevice 104 may generate the tokens used in the pairing process, or theagent 400 may generate the tokens used in the pairing process. In various embodiments, execution of a discovery process such as those described previously, and in particular a discovery process including an authorization token, may trigger a pairing request or may be treated as a pairing request by, e.g., the manageddevice 104, or thecloud service infrastructure 108. - In various embodiments, the
agent 400 may send a list of device UID's, each UID uniquely identifying one device, such as the manageddevice 104, and the list of multiple devices may be deemed by thecloud service infrastructure 108 to be a request for pairing to each of the devices, and thecloud service infrastructure 108 may generate multiple unlock tokens and paring tokens to complete multiple pairings in accord with any of the processes discussed above. - While the processes described above may result in pairing the managed
device 104 with theuser 102 and/or themanagement agent 204, in some embodiments the pairing is achieved during the discovery process previously described. For example, during the discovery process a list of one or more UID's may be provided to thecloud service infrastructure 108, as previously described. Thecloud service infrastructure 108 may know the identity of a user, an owner, or a network on which the devices are connected and thereby associate (or pair) the devices with the user, owner, or network. For example, thecloud service infrastructure 108 may associate the identified devices with an identifier of the agent or user (e.g., IP address or account information associated themanagement agent 204, thediscovery agent 220, or the user 102). Additionally, the UID of a device may indicate what user or agent it should be associated with or where it is located. For example, the UID may include a serial number or MAC address, and a database of sales records may indicate who purchased the device. Alternately, the UID or the communication packet in which it is communicated may include an IP address which may identify a network, include a network portion, or otherwise identify a group of related devices (e.g., on the same LAN) and thecloud service infrastructure 108 may associate the identified devices with an agent or user on record as being associated with the network, portion, or group. - Once the
cloud service infrastructure 108 is in communication with the manageddevice 104, which may optionally occur with or without the authentication and pairing described above, thecloud service infrastructure 108 can exchange a variety of information with thelocal user 102, theremote user 114, or an internal user associated with thecloud service infrastructure 108. For instance, in at least one embodiment, thecloud service infrastructure 108 provides a dashboard user interface. In other embodiments, thecloud service infrastructure 108 may present a user interface that mimics existing hardware and software interfaces (e.g., the interface provided by a Network Management Card ("NMC") such as a UPS NMC available from APC by Schneider Electric, the interface provided by Power Chute Business Edition available from APC by Schneider Electric, or the interface provided by an ACD.) - In some embodiments, the
cloud service infrastructure 108 is configured to issue an alert to a computer system, such as thelocal computer system 106, in response to receiving information describing an event of high importance. In these embodiments, the alert issued by thecloud service infrastructure 108 is communicated via one or more channels through which thecloud service infrastructure 108 can communicate information to external entities, such as computer systems or telecommunication devices. Examples of such channels include email, text messaging, push notifications, and automated telephone calls. - In some embodiments, the
cloud service infrastructure 108 provides different information to different types of users. Thecloud service infrastructure 108 may discriminate what information to share based upon authentication and pairing as described above. This information may include monitoring information describing the performance characteristics of one or more managed devices, test information generated from periodic execution of tests by one or more managed devices, customer use information generated by customer interaction with one or more managed devices, service information generated by self-diagnostic activities executed by one or more managed devices, and operation information generated by operational activity of one or more managed devices. In some embodiments, thecloud service infrastructure 108 may provide performance characteristics to engineering users, customer use information to marketing users, service information to re-sellers, distributors, or service organizations, and operation information to customers. Further examples of protocols and communications with and about managed devices that may be incorporated into embodiments herein are described inUS Patent No. 8,819,170 titled COMMUNICATION PROTOCOLS, issued August 26, 2014 , andUS Patent Application Publication No. 2015/0012763 titled SYSTEMS AND METHODS OF REMOTE COMMUNICATION, published Jan 8, 2015 . - Embodiments disclosed herein are not limited to the particular configurations illustrated. For example, some embodiments include multiple cloud services that operate in parallel to scale the computing resources available to the cloud-based management system. In some examples, multiple users of different types access the same managed device. In other examples, a single user accesses multiple managed devices. Thus embodiments are not limited by a specific number of users, managed devices, cloud services or cloud servers.
- In addition, various embodiments utilize a variety of hardware components, software components and combinations of hardware and software components configured to perform the processes and functions described herein. For instance, in at least one embodiment, the
cloud service infrastructure 108 is implemented as a consolidated computer system, e.g., all components incorporated intocloud server 110. In other embodiments, thecloud service infrastructure 108 is implemented using a distributed computer system. - Various aspects and functions described herein may be included as specialized hardware or software components executing in one or more computer systems. One or more acts of the methods described above may be performed with a computer, where at least one act is performed in a software program housed in a computer. Non-limiting examples of computer systems include, among others, network appliances, personal computers, workstations, mainframes, networked clients, servers, media servers, application servers, database servers and web servers. Other examples of computer systems may include mobile computing devices, such as cellular phones and personal digital assistants, and network equipment, such as load balancers, routers and switches. Further, aspects may be located on a single computer system or may be distributed among a plurality of computer systems connected to one or more communications networks.
- For example, various aspects and functions may be distributed among one or more computer systems configured to provide a service to one or more client computers, or to perform an overall task as part of a distributed system. Additionally, aspects may be performed on a client-server or multi-tier system that includes components distributed among one or more server systems that perform various functions. Consequently, examples are not limited to executing on any particular system or group of systems. Further, aspects and functions may be implemented in software, hardware or firmware, or any combination thereof. Thus, aspects and functions may be implemented within methods, acts, systems, system elements and components using a variety of hardware and software configurations, and examples are not limited to any particular distributed architecture, network, or communication protocol.
- Referring to
FIG. 5 , there is illustrated a block diagram of a distributedcomputer system 500, in which various aspects and functions are practiced. As shown, the distributedcomputer system 500 includes one or more computer systems that exchange information. More specifically, the distributedcomputer system 500 includes computer systems/devices devices communication network 508. Thenetwork 508 may include any communication network through which computer systems may exchange data. To exchange data using thenetwork 508, the computer systems/devices network 508 may use various methods, protocols and standards, including, among others, Fibre Channel, Token Ring, Ethernet, Wireless Ethernet, Bluetooth, IP, IPV6, TCP/IP, UDP, DTN, HTTP, FTP, SNMP, SMS, MMS, SS7, JSON, SOAP, CORBA, REST and Web Services. To ensure data transfer is secure, thecomputer systems network 508 using a variety of security measures including, for example, TLS, SSL or VPN. While the distributedcomputer system 500 illustrates three networked computer systems, the distributedcomputer system 500 is not so limited and may include any number of computer systems and computing devices, networked using any medium and communication protocol. - As illustrated in
FIG. 5 , thecomputer system 502 includes aprocessor 510, amemory 512, aninterconnection element 514, aninterface 516 anddata storage element 518. To implement at least some of the aspects, functions and processes disclosed herein, theprocessor 510 performs a series of instructions that result in manipulated data. Theprocessor 510 may be any type of processor, multiprocessor or controller. Some example processors include commercially available processors such as an Intel Atom, Itanium, Core, Celeron, or Pentium processor, an AMD Opteron processor, an Apple A4 or A5 processor, a Sun UltraSPARC or IBM Power5+ processor and an IBM mainframe chip. Theprocessor 510 is connected to other system components, including one ormore memory devices 512, by theinterconnection element 514. - The
memory 512 stores programs and data during operation of thecomputer system 502. Thus, thememory 512 may be a relatively high performance, volatile, random access memory such as a dynamic random access memory ("DRAM") or static memory ("SRAM"). However, thememory 512 may include any device for storing data, such as a disk drive or other nonvolatile storage device. Various examples may organize thememory 512 into particularized and, in some cases, unique structures to perform the functions disclosed herein. These data structures may be sized and organized to store values for particular data and types of data. - Components of the
computer system 502 are coupled by an interconnection element such as theinterconnection element 514. Theinterconnection element 514 may include one or more physical busses, for example, busses between components that are integrated within a same machine, but may include any communication coupling between system elements including specialized or standard computing bus technologies such as IDE, SCSI, PCI and InfiniBand. Theinterconnection element 514 enables communications, such as data and instructions, to be exchanged between system components of thecomputer system 502. - The
computer system 502 also includes one ormore interface devices 516 such as input devices, output devices and combination input/output devices. Interface devices may receive input or provide output. More particularly, output devices may render information for external presentation. Input devices may accept information from external sources. Examples of interface devices include keyboards, mouse devices, trackballs, microphones, touch screens, printing devices, display screens, speakers, network interface cards, etc. Interface devices allow thecomputer system 502 to exchange information and to communicate with external entities, such as users and other systems. - The
data storage element 518 includes a computer readable and writeable nonvolatile, or non-transitory, data storage medium in which instructions are stored that define a program or other object that is executed by theprocessor 510. Thedata storage element 518 also may include information that is recorded, on or in, the medium, and that is processed by theprocessor 510 during execution of the program. More specifically, the information may be stored in one or more data structures specifically configured to conserve storage space or increase data exchange performance. The instructions may be persistently stored as encoded signals, and the instructions may cause theprocessor 510 to perform any of the functions described herein. The medium may, for example, be optical disk, magnetic disk or flash memory, among others. In operation, theprocessor 510 or some other controller causes data to be read from the nonvolatile recording medium into another memory, such as thememory 512, that allows for faster access to the information by theprocessor 510 than does the storage medium included in thedata storage element 518. The memory may be located in thedata storage element 518 or in thememory 512, however, theprocessor 510 manipulates the data within the memory, and then copies the data to the storage medium associated with thedata storage element 518 after processing is completed. A variety of components may manage data movement between the storage medium and other memory elements and examples are not limited to particular data management components. Further, examples are not limited to a particular memory system or data storage system. - The
computer system 502 as generally described provides one or more examples of the physical embodiments of a system that may be used to implement the various devices and components of the cloud-basedmanagement system 100. In particular, each of the manageddevice 104, thelocal computer system 106, theremote computer system 116, thevarious IT equipment 202, and components of thecloud service infrastructure 108, including thecloud server 110, may be implemented using a combination of the hardware structures as disclosed herein as theexample computer system 502. - Although the
computer system 502 is shown by way of example as one type of computer system upon which various aspects and functions may be practiced, aspects and functions are not limited to being implemented on thecomputer system 502. Various aspects and functions may be practiced on one or more computers having a different architectures or components than that shown inFIG. 5 . For instance, thecomputer system 502 may include specially programmed, special-purpose hardware, such as an application-specific integrated circuit ("ASIC") tailored to perform a particular operation disclosed herein. While another example may perform the same function using a grid of several computing devices running MAC OS X with IBM PowerPC processors and several specialized computing devices running proprietary hardware and operating systems. - The
computer system 502 may be a computer system including an operating system that manages at least a portion of the hardware elements included in thecomputer system 502. In some examples, a processor or controller, such as theprocessor 510, executes an operating system. Examples of a particular operating system that may be executed include a Windows-based operating system, such as the Windows 8 operating system, available from the Microsoft Corporation, a MAC OS X operating system or an iOS operating system available from Apple Computer, one of many Linux-based operating system distributions, for example, the Enterprise Linux operating system available from Red Hat Inc., a Solaris operating system available from Sun Microsystems, or a UNIX operating systems available from various sources. Many other operating systems may be used, and examples are not limited to any particular operating system. - The
processor 510 and operating system together define a computer platform for which application programs in high-level programming languages are written. These component applications may be executable, intermediate, bytecode or interpreted code which communicates over a communication network, for example, the Internet, using a communication protocol, for example, TCP/IP. Similarly, aspects may be implemented using an object-oriented programming language, such as .Net, SmallTalk, Java, C++, Ada, C# (C-Sharp), Python, or JavaScript. Other object-oriented programming languages may also be used. Alternatively, functional, scripting, or logical programming languages may be used. - Additionally, various aspects and functions may be implemented in a non-programmed environment, for example, documents created in HTML, XML or other format that, when viewed in a window of a browser program, can render aspects of a graphical-user interface or perform other functions. Further, various examples may be implemented as programmed or non-programmed elements, or any combination thereof. For example, a web page may be implemented using HTML while a data object called from within the web page may be written in C++ or Python. Thus, the examples are not limited to a specific programming language and any suitable programming language could be used. Accordingly, the functional components disclosed herein may include a wide variety of elements, e.g. specialized hardware, executable code, data structures or objects, which are configured to perform the functions described herein.
- In some examples, the components disclosed herein may read parameters that affect the functions performed by the components. These parameters may be physically stored in any form of suitable memory including volatile memory (such as RAM) or nonvolatile memory (such as a magnetic hard drive). In addition, the parameters may be logically stored in a propriety data structure (such as a database or file defined by a user mode application) or in a commonly shared data structure (such as an application registry that is defined by an operating system). In addition, some examples provide for both system and user interfaces that allow external entities to modify the parameters and thereby configure the behavior of the components.
- Having thus described several aspects of at least one embodiment, the scope of protection sought is delimited by the appended claims.
Claims (16)
- A cloud-based management system (100) comprising a cloud server (110), a managed device (104) and an agent (400), wherein the cloud server (110) comprises:a network interface coupled to a managed device (104) and an agent (400) via a network (112); anda controller coupled to the network interface and configured to:receive, over the network, an identifier of the managed device;receive, over the network, from the agent, a request to pair with the managed device;provide, over the network, an unlock token to the managed device responsive to receiving the request to pair with the managed device;provide, over the network, the unlock token and a pairing token to the agent responsive to receiving the request to pair with the managed device, the agent being configured to provide the unlock token to the managed device responsive to receiving the unlock token from the cloud server;receive, over the network, a pairing token from the managed device, the pairing token being sent by the managed device to the cloud server based on the managed device validating the unlock token received from the agent;validate the received pairing token using the provided pairing token; andpair the agent with the managed device responsive to a successful validation of the received pairing token using the provided pairing token.
- The cloud-based management system of claim 1, wherein the unlock token, the provided pairing token, or the received pairing token includes at least one of a cryptographic token or a timed token.
- The cloud-based management system of claim 1, the controller comprised by the cloud server being further configured to:receive, from the agent, management information over the network using one of a network management protocol or a hypertext transfer protocol; andprovide the management information over the network to the managed device using a machine-to-machine protocol.
- The cloud-based management system of claim 1, wherein pairing the agent with the managed device includes authenticating a user of the agent.
- The cloud-based management system of claim 1, wherein pairing the agent with the managed device includes determining capabilities of the managed device.
- The cloud-based management system of claim 1, wherein the request to pair with the managed device includes the identifier of the managed device.
- The cloud-based management system of claim 1, wherein validating the received token using the provided pairing token includes matching the provided pairing token to the received pairing token.
- The cloud-based management system of claim 1, wherein the controller comprised by the cloud server is further configured to:receive, over the network from the agent, a request to pair with each managed device of a plurality of managed devices, the plurality of managed devices including the managed device; andpair the agent with each managed device of the plurality of managed devices.
- A method of managing a managed device (104), the method comprising:receiving, by a cloud server (110) over a network, an identifier of the managed device;receiving by the cloud server over the network, from an agent (400), a request to pair with the managed device;providing, over the network, an unlock token to the managed device responsive to receiving the request to pair with the managed device;providing, over the network, the unlock token and a pairing token to the agent responsive to receiving the request to pair with the managed device, the agent being configured to provide the unlock token to the managed device responsive to receiving the unlock token from the cloud server;receiving, over the network, a pairing token from the managed device, the pairing token being sent by the managed device to the cloud server based on the managed device validating the unlock token received from the agent;validating the received pairing token using the provided pairing token; andpairing the agent with the managed device responsive to a successful validation of the received pairing token using the provided pairing token.
- The method of claim 9, wherein the unlock token, the provided pairing token, or the received pairing token includes at least one of a cryptographic token or a timed token.
- The method of claim 9, further comprising:receiving, from the agent, management information over the network using one of a network management protocol or a hypertext transfer protocol; andproviding the management information over the network to the managed device using a machine-to-machine protocol.
- The method of claim 9, wherein pairing the agent with the managed device includes authenticating a user of the agent.
- The method of claim 9, wherein pairing the agent with the managed device includes determining capabilities of the managed device.
- The method of claim 9, wherein the request to pair with the managed device includes the identifier of the managed device.
- The method of claim 9, wherein validating the received pairing token using the provided pairing token includes matching the provided pairing token to the received pairing token.
- A computer-program including instructions which, when executed on a computer, perform the method of any of claims 9-15.
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/219,843 US10404779B2 (en) | 2016-07-26 | 2016-07-26 | Cloud assisted management of devices |
EP17181058.3A EP3276919B8 (en) | 2016-07-26 | 2017-07-12 | Cloud assisted management of devices |
Related Parent Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP17181058.3A Division EP3276919B8 (en) | 2016-07-26 | 2017-07-12 | Cloud assisted management of devices |
EP17181058.3A Division-Into EP3276919B8 (en) | 2016-07-26 | 2017-07-12 | Cloud assisted management of devices |
Publications (2)
Publication Number | Publication Date |
---|---|
EP3829141A1 EP3829141A1 (en) | 2021-06-02 |
EP3829141B1 true EP3829141B1 (en) | 2023-09-13 |
Family
ID=59350687
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP17181058.3A Active EP3276919B8 (en) | 2016-07-26 | 2017-07-12 | Cloud assisted management of devices |
EP21153051.4A Active EP3829141B1 (en) | 2016-07-26 | 2017-07-12 | Cloud assisted management of devices |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP17181058.3A Active EP3276919B8 (en) | 2016-07-26 | 2017-07-12 | Cloud assisted management of devices |
Country Status (3)
Country | Link |
---|---|
US (1) | US10404779B2 (en) |
EP (2) | EP3276919B8 (en) |
CN (2) | CN107659606B (en) |
Families Citing this family (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20180059648A1 (en) * | 2016-08-31 | 2018-03-01 | Esab Ab | Techniques for network charting and configuration in a welding or cutting system |
CN110505075B (en) * | 2018-05-18 | 2022-11-25 | 华为技术有限公司 | Device management method and related device |
CN109101227A (en) * | 2018-08-09 | 2018-12-28 | 佛山市苔藓云链科技有限公司 | A kind of system of tracking application program interaction |
CN110032258A (en) * | 2018-12-24 | 2019-07-19 | 四川易简天下科技股份有限公司 | The mating structure of modularization, all-in-one machine and modular unit |
CN110034949A (en) * | 2019-02-21 | 2019-07-19 | 国电南瑞科技股份有限公司 | A kind of Write-protection method based on snmp protocol |
US11871308B2 (en) * | 2019-07-29 | 2024-01-09 | TapText llc | System and method for link-initiated dynamic-mode communications |
CN114007198A (en) * | 2020-07-13 | 2022-02-01 | 深圳市利维坦技术有限公司 | System and method for context-aware self-configuring logistics hardware |
US11412044B1 (en) * | 2021-12-14 | 2022-08-09 | Micro Focus Llc | Discovery of resources in a virtual private cloud |
CN115174580B (en) * | 2022-09-05 | 2023-01-17 | 睿至科技集团有限公司 | Data processing method and system based on big data |
Family Cites Families (36)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6640140B1 (en) | 2000-10-10 | 2003-10-28 | Schneider Automation Inc. | PLC executive with integrated web server |
US20020091824A1 (en) | 2001-01-10 | 2002-07-11 | Center 7, Inc. | Intermediate systems for enterprise management from a central location |
US7114098B2 (en) | 2001-03-20 | 2006-09-26 | American Power Conversion Corporation | Power supply critical state monitoring system |
US7100054B2 (en) | 2001-08-09 | 2006-08-29 | American Power Conversion | Computer network security system |
US6815640B1 (en) | 2002-07-09 | 2004-11-09 | Lincoln Global, Inc. | Apparatus, system and method to facilitate reconfigurable welding power supply |
US20040215693A1 (en) | 2003-03-26 | 2004-10-28 | Jim Thompson | Apparatus, methods and computer program products for power monitoring using networked UPS clients |
US7446433B2 (en) | 2004-01-23 | 2008-11-04 | American Power Conversion Corporation | Methods and apparatus for providing uninterruptible power |
US20050268122A1 (en) | 2004-05-28 | 2005-12-01 | Young Brian R | Devices and methods for validating network connections |
TWI248567B (en) | 2004-09-08 | 2006-02-01 | Delta Electronics Inc | Uninterruptible power supply with network hub functions |
US7711814B1 (en) | 2004-12-13 | 2010-05-04 | American Power Conversion Corporation | Method and system for remote monitoring of a power supply device with user registration capability |
US7350088B2 (en) | 2005-03-08 | 2008-03-25 | Hewlett-Packard Development Company, L.P. | Power management system for UPS attached to external devices |
US7796589B2 (en) | 2005-08-01 | 2010-09-14 | American Power Conversion Corporation | Communication protocol |
US8447843B2 (en) | 2006-09-25 | 2013-05-21 | Yoics, Inc. | System, method and computer program product for identifying, configuring and accessing a device on a network |
US8527612B2 (en) | 2008-10-31 | 2013-09-03 | Eaton Corporation | Methods, devices and computer program products for configuring network-enabled devices |
US8407018B2 (en) | 2009-03-24 | 2013-03-26 | American Power Conversion Corporation | Battery life estimation |
US8639953B2 (en) | 2009-03-27 | 2014-01-28 | Schneider Electric It Corporation | System and method for gathering information using a power device wherein information is associated with at least one external load |
US8476787B2 (en) | 2009-03-27 | 2013-07-02 | Schneider Electric It Corporation | System and method for changing power states of a power device |
US8509954B2 (en) | 2009-08-21 | 2013-08-13 | Allure Energy, Inc. | Energy management system and method |
JP2011235493A (en) | 2010-05-07 | 2011-11-24 | Seiko Epson Corp | Communication unit |
US8819170B2 (en) | 2011-07-14 | 2014-08-26 | Schneider Electric It Corporation | Communication protocols |
US8412945B2 (en) * | 2011-08-09 | 2013-04-02 | CloudPassage, Inc. | Systems and methods for implementing security in a cloud computing environment |
IN2014CN03766A (en) | 2011-10-24 | 2015-07-03 | Schneider Electric Ind Sas | |
CN104126182B (en) | 2011-12-30 | 2018-02-09 | 施耐德电气It公司 | The system and method for telecommunication |
GB2498708B (en) * | 2012-01-17 | 2020-02-12 | Secure Cloudlink Ltd | Security management for cloud services |
US8856885B2 (en) * | 2012-04-30 | 2014-10-07 | Citrix Systems, Inc. | Managing cloud zones |
US9038138B2 (en) * | 2012-09-10 | 2015-05-19 | Adobe Systems Incorporated | Device token protocol for authorization and persistent authentication shared across applications |
US20160026201A1 (en) | 2013-07-26 | 2016-01-28 | Mohan Vellanki | Systems and methods for controlling electrical devices |
US10891155B2 (en) * | 2014-01-03 | 2021-01-12 | Mcafee, Llc | Wearable device task offloading to conserve processing resources |
CN104008028B (en) * | 2014-05-22 | 2017-03-15 | 北京大学 | Intelligent mobile terminal data backup memory method and system based on many cloud storages |
US10349248B2 (en) * | 2014-06-02 | 2019-07-09 | Telefonaktiebolaget Lm Ericsson (Publ) | Merging proxy |
EP2961208A1 (en) * | 2014-06-27 | 2015-12-30 | Gemalto SA | Method for accessing a service and corresponding application server, device and system |
CN104618501A (en) * | 2015-02-15 | 2015-05-13 | 浪潮电子信息产业股份有限公司 | Wireless intelligent monitoring management device of server cluster system |
CN104994073B (en) * | 2015-05-29 | 2019-03-19 | 北京奇虎科技有限公司 | Mobile phone terminal, server and its account number and apparatus bound control execute method |
US9843453B2 (en) * | 2015-10-23 | 2017-12-12 | Pure Storage, Inc. | Authorizing I/O commands with I/O tokens |
US10341862B2 (en) * | 2016-02-05 | 2019-07-02 | Verizon Patent And Licensing Inc. | Authenticating mobile devices |
US9935867B2 (en) * | 2016-03-11 | 2018-04-03 | Dell Products L.P. | Diagnostic service for devices that employ a device agent |
-
2016
- 2016-07-26 US US15/219,843 patent/US10404779B2/en active Active
-
2017
- 2017-07-12 EP EP17181058.3A patent/EP3276919B8/en active Active
- 2017-07-12 EP EP21153051.4A patent/EP3829141B1/en active Active
- 2017-07-21 CN CN201710600404.8A patent/CN107659606B/en active Active
- 2017-07-21 CN CN202011301189.XA patent/CN112600870B/en active Active
Also Published As
Publication number | Publication date |
---|---|
CN107659606B (en) | 2020-12-08 |
EP3829141A1 (en) | 2021-06-02 |
EP3276919A1 (en) | 2018-01-31 |
CN112600870A (en) | 2021-04-02 |
US10404779B2 (en) | 2019-09-03 |
US20180034888A1 (en) | 2018-02-01 |
EP3276919B1 (en) | 2021-03-03 |
EP3276919B8 (en) | 2021-09-08 |
CN107659606A (en) | 2018-02-02 |
CN112600870B (en) | 2023-12-19 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP3829141B1 (en) | Cloud assisted management of devices | |
EP2798509B1 (en) | Systems and methods of remote communication | |
EP2772025A1 (en) | Systems and methods of remote communication | |
US20130347085A1 (en) | Data exfiltration attack simulation technology | |
US10503942B1 (en) | Systems and methods for a data center monitoring system | |
TW200915063A (en) | Remote health monitoring and control | |
EP2981893B1 (en) | Analyzing scada systems | |
CN113424157A (en) | Multi-dimensional periodic detection of IoT device behavior | |
US20160013988A1 (en) | Systems and methods for automatically clustering devices | |
WO2014099690A1 (en) | Hardware management interface | |
KR20160072391A (en) | the Integrated Access Security Management for Smart Work Environment and method thereof | |
Polge et al. | Assessing the impact of attacks on opc-ua applications in the industry 4.0 era | |
US11799858B2 (en) | Network entity ID AAA | |
Guo et al. | A survey of industrial control system devices on the Internet | |
Haar et al. | Fane: a firewall appliance for the smart home | |
US20130174261A1 (en) | System and Method of Securing Monitoring Devices on a Public Network | |
CN108933707B (en) | Safety monitoring system and method for industrial network | |
WO2015025373A1 (en) | Oa apparatus suitable for providing management security service, and security service provision method using said oa apparatus | |
Syed et al. | Fast attack detection using correlation and summarizing of security alerts in grid computing networks | |
US11784973B2 (en) | Edge-based enterprise network security appliance and system | |
Lakshitha Karthik et al. | Automatic Network Scanning System for Monitoring 4G and 5G Network Elements | |
Adekolu et al. | Network Monitoring |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED |
|
AC | Divisional application: reference to earlier application |
Ref document number: 3276919 Country of ref document: EP Kind code of ref document: P |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20211202 |
|
RBV | Designated contracting states (corrected) |
Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R079 Ref document number: 602017074330 Country of ref document: DE Free format text: PREVIOUS MAIN CLASS: H04L0029080000 Ipc: H04L0009320000 Ref country code: DE Ref legal event code: R079 Free format text: PREVIOUS MAIN CLASS: H04L0029080000 Ipc: H04L0009320000 |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: H04L 67/025 20220101ALI20221221BHEP Ipc: H04L 67/12 20220101ALI20221221BHEP Ipc: H04W 12/50 20210101ALI20221221BHEP Ipc: H04L 9/40 20220101ALI20221221BHEP Ipc: H04L 43/0817 20220101ALI20221221BHEP Ipc: H04L 41/12 20220101ALI20221221BHEP Ipc: H04L 41/0226 20220101ALI20221221BHEP Ipc: H04L 41/0213 20220101ALI20221221BHEP Ipc: H04W 4/70 20180101ALI20221221BHEP Ipc: H04L 9/32 20060101AFI20221221BHEP Ipc: H04W 12/06 20210101ALI20221221BHEP Ipc: H04L 69/329 20220101ALI20221221BHEP Ipc: H04L 67/146 20220101ALI20221221BHEP Ipc: H04L 67/125 20220101ALI20221221BHEP |
|
GRAP | Despatch of communication of intention to grant a patent |
Free format text: ORIGINAL CODE: EPIDOSNIGR1 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: GRANT OF PATENT IS INTENDED |
|
INTG | Intention to grant announced |
Effective date: 20230131 |
|
GRAS | Grant fee paid |
Free format text: ORIGINAL CODE: EPIDOSNIGR3 |
|
RAP3 | Party data changed (applicant data changed or rights of an application transferred) |
Owner name: SCHNEIDER ELECTRIC IT CORPORATION |
|
GRAA | (expected) grant |
Free format text: ORIGINAL CODE: 0009210 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE PATENT HAS BEEN GRANTED |
|
AC | Divisional application: reference to earlier application |
Ref document number: 3276919 Country of ref document: EP Kind code of ref document: P |
|
AK | Designated contracting states |
Kind code of ref document: B1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
|
REG | Reference to a national code |
Ref country code: CH Ref legal event code: EP |
|
REG | Reference to a national code |
Ref country code: DE Ref legal event code: R096 Ref document number: 602017074330 Country of ref document: DE |
|
REG | Reference to a national code |
Ref country code: IE Ref legal event code: FG4D |
|
REG | Reference to a national code |
Ref country code: LT Ref legal event code: MG9D |
|
REG | Reference to a national code |
Ref country code: NL Ref legal event code: MP Effective date: 20230913 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20231214 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: RS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: NO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20231213 Ref country code: LV Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: LT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: HR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: GR Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20231214 Ref country code: FI Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 |
|
REG | Reference to a national code |
Ref country code: AT Ref legal event code: MK05 Ref document number: 1612399 Country of ref document: AT Kind code of ref document: T Effective date: 20230913 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: NL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20240113 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: AT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: ES Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: SM Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: RO Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: IS Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20240113 Ref country code: ES Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: EE Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: CZ Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: AT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: SK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: PT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20240115 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: PL Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 Ref country code: IT Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 |
|
PG25 | Lapsed in a contracting state [announced via postgrant information from national office to epo] |
Ref country code: DK Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT Effective date: 20230913 |
|
PLBE | No opposition filed within time limit |
Free format text: ORIGINAL CODE: 0009261 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT |